ISO 14969:1999

INTERNATIONAL ISO
STANDARD 14969
First edition
1999-06-01
Quality systems — Medical devices —
Guidance on the application of ISO 13485
and ISO 13488
Systèmes qualité — Dispositifs médicaux — Lignes directrices pour
l'application de l'ISO 13485 et l'ISO 13488
A
Reference number
ISO 14969:1999(E)

---------------------- Page: 1 ----------------------
ISO 14969:1999(E)
Contents
1 Scope .1
2 Normative references .2
3 Terms and definitions .2
4 Quality system requirements .2
4.1 Management responsibility .2
4.2 Quality system .3
4.3 Contract review.3
4.4 Design control.3
4.5 Document and data control .7
4.6 Purchasing .8
4.7 Control of customer-supplied product.10
4.8 Product identification and traceability .10
4.9 Process control.11
4.10 Inspection and testing.15
4.11 Control of inspection, measuring and test equipment .16
4.12 Inspection and test status .17
4.13 Control of nonconforming product.17
4.14 Corrective and preventive action .18
4.15 Handling, storage, packaging, preservation and delivery.21
4.16 Control of quality records.23
4.17 Internal quality audits.24
4.18 Training.25
4.19 Servicing.25
©  ISO 1999
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic
or mechanical, including photocopying and microfilm, without permission in writing from the publisher.
International Organization for Standardization
Case postale 56 • CH-1211 Genève 20 • Switzerland
Internet iso@iso.ch
Printed in Switzerland
ii

---------------------- Page: 2 ----------------------
© ISO
ISO 14969:1999(E)
4.20 Statistical techniques. 25
Annex A (informative) Comparison of International Standards on quality system requirements for medical
devices. 26
Annex B (informative) Terms used in certain regulatory administrations to describe documents referenced
in this International Standard. 29
Bibliography. 30
iii

---------------------- Page: 3 ----------------------
© ISO
ISO 14969:1999(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO
member bodies). The work of preparing International Standards is normally carried out through ISO technical
committees. Each member body interested in a subject for which a technical committee has been established has
the right to be represented on that committee. International organizations, governmental and non-governmental, in
liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical
Commission (IEC) on all matters of electrotechnical standardization.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 3.
Draft International Standards adopted by the technical committees are circulated to the member bodies for voting.
Publication as an International Standard requires approval by at least 75% of the member bodies casting a vote.
International Standard ISO 14969 was prepared by Technical Committee ISO/TC 210, Quality management and
corresponding general aspects for medical devices.
Annexes A and B of this International Standard are for information only.
iv

---------------------- Page: 4 ----------------------
© ISO
ISO 14969:1999(E)
Introduction
This International Standard provides guidance to assist in the development, implementation, maintenance and
improvement of medical device related quality systems that meet the requirements of ISO 13485 and ISO 13488.
These standards specify, in conjunction with ISO 9001 and ISO 9002 respectively, the quality system requirements
for medical devices (see Table A.1 in annex A). For this reason, this International Standard also contains guidance
applicable to medical devices based on the generic requirements of ISO 9001 and ISO 9002. ISO 13488 differs
from ISO 13485 in that the former does not contain requirements for design control. This International Standard also
gives guidance on ways to meet globally harmonized regulatory quality system requirements for medical devices.
When judging the applicability of the guidance in this International Standard, one should consider the nature of the
medical device(s) to which it will apply, the potential risk associated with the use of these devices, and the
applicable regulatory requirements.
As used in this International Standard, the term “regulatory requirement” includes any part of a law, ordinance,
decree or national and/or regional regulatory requirement which applies to quality systems of medical device
manufacturers.
v

---------------------- Page: 5 ----------------------
INTERNATIONAL STANDARD  © ISO ISO 14969:1999(E)
Quality systems — Medical devices — Guidance on the
application of ISO 13485 and ISO 13488
1 Scope
This International Standard provides guidance for the application of the requirements for medical device quality
systems contained in ISO 13485 and ISO 13488. It does not add to, or otherwise change, the requirements of
ISO 13485 and ISO 13488. This guidance can be used to better understand alternative methods and approaches
among many (not specifically included here) for applying the requirements of ISO 13485 and ISO 13488.
The guidance provided by this International Standard has value for:
 suppliers seeking to implement and maintain quality systems that comply with ISO 13485 and ISO 13488;
 organizations having the responsibility to assess the successful implementation and maintenance of such
quality systems; and
 regulatory bodies seeking to enforce regulatory requirements based on the requirements of ISO 13485 and
ISO 13488.
These organizations and regulatory bodies should understand the benefits of the guidance given in this International
Standard and the special considerations associated with the use of this guidance.
a) For suppliers
The guidance given in this International Standard is applicable to the design, development (ISO 13485 only),
production, installation, and servicing of medical devices of all kinds. It describes concepts and methods which can
be considered by suppliers who are establishing and maintaining quality systems.
Special considerations: The supplier has the responsibility for determining which of the guidance contained in this
International Standard is relevant to its operations and will be incorporated in its quality system. The supplier should
understand that if it voluntarily incorporates guidance from this International Standard into its quality system, the
guidance needs to be followed, consistent with the requirements of the supplier’s quality system. Failure to comply
with those incorporated guidance can be determined to be a deficiency by those charged with the responsibility of
conducting internal or external quality system assessments, audits and inspections.
The supplier should also understand that its quality system cannot be found deficient for failure to incorporate
guidance contained in this International Standard which the supplier determines are not relevant to its operations.
b) For quality system assessors, notified bodies, regulatory enforcement bodies
Guidance contained in this International Standard can be useful as background information for those representing
quality system assessors, notified bodies and regulatory enforcement bodies.
Special considerations: The guidance contained in this International Standard should not be used for identifying
specific deficiencies of quality systems, unless such guidance is voluntarily incorporated by the supplier into the
documentation describing and supporting the supplier’s quality system, or unless such guidance is specifically made
part of the regulatory requirements relevant to the supplier’s operation.
1

---------------------- Page: 6 ----------------------
© ISO
ISO 14969:1999(E)
2 Normative references
The following normative documents contain provisions which, through reference in this text, constitute provisions of
this International Standard. For dated references, subsequent amendments to, or revisions of, any of these
publications do not apply. However, parties to agreements based on this International Standard are encouraged to
investigate the possibility of applying the most recent editions of the normative documents indicated below. For
undated references, the latest edition of the normative document referred to applies. Members of ISO and IEC
maintain registers of currently valid International Standards.
ISO 8402:1994, Quality management and quality assurance — Vocabulary.
ISO 9000-2:1997, Quality management and quality assurance standards — Part 2: Generic guidelines for the
application of ISO 9001, ISO 9002 and ISO 9003.
ISO 9001:1994, Quality systems — Model for quality assurance in design, development, production, installation and
servicing.
ISO 9002:1994, Quality systems — Model for quality assurance in production, installation and servicing.
ISO 13485:1996, Quality systems — Medical devices — Particular requirements for the application of ISO 9001.
ISO 13488:1996, Quality systems — Medical devices — Particular requirements for the application of ISO 9002.
3 Terms and definitions
For the purposes of this International Standard, the tems and definitions given in ISO 8402, ISO 13485 and
ISO 13488 apply, with the exception of “product”, where the definition in ISO 9001 and ISO 9002 applies.
NOTE The terms provided in annex B should be regarded as generic, as definitions provided in national regulatory
requirements may differ.
4 Quality system requirements
4.1 Management responsibility
4.1.1 Quality policy
There is no specific medical device guidance beyond the generic guidance given in 4.1.1 of ISO 9000-2:1997.
4.1.2 Organization
4.1.2.1 Responsibility and authority
The generic guidance given in 4.1.2.1 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
When necessary, deputies for personnel having the responsibility and authority to make decisions that control the
elements of the quality system and processes should be identified and be capable of assuming the responsibilities.
4.1.2.2 Resources
There is no specific medical device guidance beyond the generic guidance given in 4.1.2.2 of ISO 9000-2:1997.
4.1.2.3 Management representative
There is no specific medical device guidance beyond the generic guidance given in 4.1.2.3 of ISO 9000-2:1997.
2

---------------------- Page: 7 ----------------------
© ISO
ISO 14969:1999(E)
4.1.3 Management review
There is no specific medical device guidance beyond the generic guidance given in 4.1.3 of ISO 9000-2:1997.
4.2 Quality system
4.2.1 General
There is no specific medical device guidance beyond the generic guidance given in 4.2.1 of ISO 9000-2:1997.
4.2.2 Quality system procedures
There is no specific medical device guidance beyond the generic guidance given in 4.2.2 of ISO 9000-2:1997.
4.2.3 Quality planning
The generic guidance given in 4.2.3 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
The file referred to in 4.2.3 of ISO 13485 is sometimes referred to by different terms (see annex B).
4.3 Contract review
4.3.1 General
There is no specific medical device guidance beyond the generic guidance given in 4.3.1 of ISO 9000-2:1997.
4.3.2 Review
There is no specific medical device guidance beyond the generic guidance given in 4.3.2 of ISO 9000-2:1997.
4.3.3 Amendment to contract
There is no specific medical device guidance beyond the generic guidance given in 4.3.3 of ISO 9000-2:1997.
4.3.4 Records
There is no specific medical device guidance beyond the generic guidance given in 4.3.4 of ISO 9000-2:1997.
4.4 Design control
4.4.1 General
The generic guidance given in 4.4.1 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
The extent of medical device evaluations, verifications and validations should be commensurate with the nature of
the risks and the benefits associated with the use of the medical device.
Risk analysis using techniques such as fault tree analysis (FTA) and failure mode and effects analysis (FMEA) can
be utilized at various stages of the design process. Such techniques can also help to determine the nature of
possible design flaws and the risks associated with them. They may also identify changes required to increase
reliability and safety. The application of risk analysis techniques are described in ISO 14971-1 (see Bibliography).
Design-related documents and records should form part of a file as described in row A of annex B.
4.4.2 Design and development planning
The generic guidance given in 4.4.2 of ISO 9000-2:1997 applies.
3

---------------------- Page: 8 ----------------------
© ISO
ISO 14969:1999(E)
Additional guidance for all medical devices
Design and development planning can ensure that the design process is appropriately managed and that design
objectives are met. The method chosen and the detail will vary depending on the complexity of the project and the
level of risk associated with the medical device.
Generally, the design plan includes the specific quality practices, assessment methodology, documentation
requirements, record keeping, resources and the sequence of activities relevant to a particular design or design
category and the timing and content of design review. The plan should reference applicable codes, standards,
regulatory requirements, specifications and acceptance criteria. Design activities should be specified to the level of
detail necessary for carrying out the design process in a manner that permits the generation of objective evidence
that the design activity has been completed. Design plans do not have to be elaborate. They may be as simple as a
flow chart showing steps to be taken and who is responsible for taking them. If appropriate, applicable codes,
standards, regulatory requirements, specifications and acceptance criteria can be considered for inclusion in the
plan.
The decision process in deciding whether a clinical investigation and/or literature search as part of the clinical
evaluation is necessary should be addressed (see note in 4.4.8 of ISO 13485:1996).
4.4.3 Organizational and technical interfaces
The generic guidance given in 4.4.3 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
For medical devices, the design process typically involves more than just design personnel. Other internal groups
may also play a role. These include, but are not limited to, Marketing and Sales, Production, Testing, Purchasing,
Quality Assurance, Clinical Affairs, and Regulatory Affairs. In addition, groups external to the device manufacturer
may also be involved.
Operational procedures may be required to ensure that information from all levels of the organization, as required, is
available to participants in the design activity. Failure to exercise the interfaces at all levels, when appropriate, can
result in the organization’s inability to use them when necessary.
4.4.4 Design input
The generic guidance given in 4.4.4 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
The design inputs should be specified to the level necessary to permit the design activity to be carried out effectively
and to provide a consistent basis for design decisions, design verifications and design validation.
Examples of design inputs that should be defined, reviewed, approved and recorded by the supplier, include:
 intended clinical use;
 customer requirements, e.g. intended device performance (indications for use) and limits;
 performance requirements, e.g. during normal use, storage, handling and maintenance;
 specifications for various forms of labelling, e.g. instructions for use and servicing;
 environmental, safety and regulatory requirements;
 ergonomics and other human factors;
 other relevant standards;
 systems elements when a medical device is specified for use in combination with another device, e.g. other
equipment or accessory. In this case the design input should completely define the interface requirement.
In defining the design inputs, the supplier should consider foreseeable use and misuse of the product and any
related needs for specific labelling and customer/user training.
4

---------------------- Page: 9 ----------------------
© ISO
ISO 14969:1999(E)
The design input document(s) should be regarded as a living document(s) and updated and reissued as necessary
upon completion of design reviews. A record should be kept of all “agreed to” changes to the design input as it
evolves during the design process.
The design transfer process should flow more smoothly if, during the design input stage, consideration is given to
eventual production (producibility, parts/materials availability, production equipment needs, operator training etc.)
and possible conformity assessment requirements (procedures, methods, equipment).
4.4.5 Design output
The generic guidance given in 4.4.5 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
Design outputs can also include specifications for:
 raw materials;
 component parts;
 sub-assemblies;
 finished devices;
 product and process software;
 quality assurance procedures, including acceptance criteria;
 manufacturing and inspection procedures;
 packaging and labelling;
 identification and traceability procedures;
 installation and servicing procedures and materials.
As part of, or in addition to, the design output documents, it is common practice to maintain a record/file to
demonstrate that each design was developed and verified in accordance with the approved design plan.
The transfer of a design to production should occur after review and approval of specifications and procedures. The
adequacy of specifications, methods and procedures can be demonstrated through process validation, including the
testing of finished product under actual or simulated use conditions.
4.4.6 Design review
The generic guidance given in 4.4.6 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
In order to assure objectivity, it is advisable to involve one or more individuals, not having direct responsibility for the
design activity in question, in the design review. This broader involvement also enables the reviewers to take into
account all aspects of the supplier’s interest, e.g. manufacturing, marketing, design, after-sales servicing and
support, and the likely medical effectiveness of the design. For medical devices, design reviews should also
consider the following.
 Has a risk analysis been carried out to ensure that safety considerations are covered?
 Is the labelling adequate?
 Will the design reasonably accomplish the medical use intended ?
 Is the packaging adequate, particularly for sterile devices?
 Is the sterilization process adequate?
 Is the device compatible with the sterilization method?
5

---------------------- Page: 10 ----------------------
© ISO
ISO 14969:1999(E)
At the completion of significant phases of the design process, design output documents should be reviewed and
approved by designated functions prior to release for subsequent implementation; this is often accomplished
through design review.
The records of design reviews should identify those involved and the decisions reached.
4.4.7 Design verification
The generic guidance given in 4.4.7 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
Once the design is translated into a tangible form, its safety, performance and reliability should be verified for
conformance to the design inputs. Such verifications include:
 review of engineering specifications and drawings;
 physical and chemical laboratory testing (bench testing);
 in vitro testing;
 in vivo testing;
 packaging and labelling review (see 4.15.4).
4.4.8 Design validation
The generic guidance given in 4.4.8 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
Design validation goes beyond the technical issues of verifying that the design output meets the design input, and is
intended to ensure that the medical device meets user needs and the intended use. This involves consideration of
the knowledge and capabilities of the intended user, the operating instructions, compatibility with other systems, and
any restriction on the use of the product.
The medical device units employed for validations should be produced under the conditions specified as “final” for
the product, e.g. initial production units. The validation should be conducted under actual or simulated use
conditions; this can involve clinical investigations.
4.4.9 Design changes
The generic guidance given in 4.4.9 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
Whether or not the device is currently on the market, the following considerations, among others, should be
addressed before permitting a change to an approved design.
 Will the product still conform to the agreed-to product requirements?
 Will the product still conform to the agreed-to product specifications?
 Will the intended use be affected?
 Will different components of the product or system be affected by the change?
 Will there be a need for further interface design; i.e. physical contact with other components in a product or
system?
 Will the change create problems in manufacture, installation or use?
 Will the design still be verifiable?
 Will the change affect the regulatory status of the product?
6

---------------------- Page: 11 ----------------------
© ISO
ISO 14969:1999(E)
4.5 Document and data control
4.5.1 General
The generic guidance given in 4.5.1 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
Examples of documents and data which should be subject to formal control procedures are:
 quality manual;
 standard operating procedures, test methods and work instructions;
 technical data, e.g. purchase specifications, drawings, process specifications, packaging/labelling specifi-
cations;
 relevant promotional material, user manuals, service manuals, etc.;
 back-up of electronic versions of quality system documents and data.
To the extent applicable, copies of published external standards, regulatory requirements and codes of practice
which relate to the quality system or product specification should be controlled in such a way as to identify clearly
which version is being used.
4.5.2 Document and data approval and issue
The generic guidance given in 4.5.2 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
The established system for the control of documents and data should:
 include periodic review of documents, if required by the quality system;
 assign responsibilities for preparation, check release and issue of documents;
 require review of all quality related documents for accuracy completeness and correctness before approval and
issue;
 identify recipients of controlled copies of documents;
 ensure prompt withdrawal of obsolete copies of controlled documents (see 4.5.2);
 define a method for recording the implementation date of a document change.
Document control procedures may be assisted by the adoption of a consistent structure for the documents within
the quality system. These procedures should clearly indicate which document control information should be
included in the individual controlled documents. Consideration should be given to the inclusion of:
 title and scope;
 document reference number;
 date of issue/date effective;
 revision status;
 review date or review frequency, if periodic review is required by the quality system;
 revision history;
 the originator or author;
 the person(s) approving it;
 the person(s) issuing it;
 the distribution;
 pagination; and
 computer file reference, if applicable.
The document control system should allow controlled and non-controlled documents to be distinguished.
Retention of clearly marked obsolete and superseded controlled documents can assist in providing a full picture of
the product’s life cycle.
7

---------------------- Page: 12 ----------------------
© ISO
ISO 14969:1999(E)
4.5.3 Document and data changes
The generic guidance given in 4.5.3 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
Changes to documents and data, including computer-based documents, should be made by authorized personnel
(e.g. persons with an access code to the document and data file to be changed). The approval of authorized
changes should be identified in the document (or data) or in its change history. Prevention of unauthorized changes
to computer-based documents and data can be facilitated by making “read only” copies available to persons who
have a need to use them but are not authorized to change them.
4.6 Purchasing
4.6.1 General
The generic guidance given in 4.6.1 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
A supplier can purchase, from a number of sources, products and services which can directly or indirectly affect the
safety, effectiveness and general quality of the finished medical device. These products and services typically
include:
 raw materials;
 components or sub-assemblies manufactured by others using equipment owned by, and/or materials provided
by, the supplier;
 components or sub-assemblies available as standard items from other sources;
 components or sub-assemblies manufactured by others to the supplier’s specifications;
 completed product bearing the mark and/or name of the device manufacturer; this may be ready for sale or
require some further processing such as packaging and/or sterilization;
 packaging material either as a standard item or manufactured to the supplier’s specification;
 labelling manufactured to the supplier’s specification;
 services, e.g. machining, heat treating, sterilization, calibration, testing, pest control, waste disposal, cleaning,
environmental monitoring, laundry, transport, installation;
 specialist professional advice/consulting services.
4.6.2 Evaluation of subcontractors
The generic guidance given in 4.6.2 of ISO 9000-2:1997 applies.
Additional guidance for all medical devices
The term “subcontractor” is taken to include providers to the supplier of materials, components, sub-assemblies,
finished medical devices or services.
The selection of potential subcontractors can typically include evaluation of the facilities, capabilitie
...